KernelCare : Live Kernel Patching

#%NASL_MIN_LEVEL 80900
#
# (C) Tenable Network Security, Inc.
#

include("compat.inc");

if (description)
{
  script_id(286277);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/01/15");
  script_name(english:"KernelCare : Live Kernel Patching");

  script_set_attribute(
    attribute:"synopsis", value:
"The remote host is using KernelCare to maintain the OS kernel.");

  script_set_attribute(
    attribute:"description", value:
"KernelCare is being used to maintain the remote host's operating
system kernel without requiring reboots."
  );
  #https://tuxcare.com/enterprise-live-patching-services/kernelcare-enterprise/
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b9961fba");
  script_set_attribute(attribute:"solution", value:"n/a");
  script_set_attribute(attribute:"risk_factor", value:"None");

  script_set_attribute(attribute:"plugin_type", value:"local");

  script_set_attribute(attribute:"plugin_publication_date", value:"2026/01/15");
  script_set_attribute(attribute:"agent", value:"unix");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");
  script_family(english:"General");

  script_dependencies("ssh_get_info2.nasl");
  script_require_keys("Host/local_checks_enabled");

  exit(0);
}

include("lists.inc");
include("nasl_wrappers.inc");

if(!get_kb_item("Host/local_checks_enabled"))
  audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);

var version = get_kb_item("Host/kernelcare/version");

if(!version)
  audit(AUDIT_NOT_INST, "KernelCare");

# Check for kernelcare status data
var status = get_one_kb_item("Host/kernelcare/patch-info");
var cves = {};
var cve_match, cve_list;
if(!empty_or_null(status))
{
  var skipped = false;
  var status_split = split(status, sep:'\n', keep:FALSE);
  foreach line (status_split)
  {
    line = nasl_wrappers::trim(line);

    if(empty_or_null(line))
    {
      skipped = false;
      continue;
    }

    if(preg(string:line, pattern:"^kpatch-name: skipped/"))
      skipped = true;

    if(!skipped && preg(string:line, pattern:"kpatch-cve:"))
    {
      cve_match = pregmatch(string:line, pattern:"(CVE-\d{4}-\d{4,})");
      if(!empty_or_null(cve_match) && !empty_or_null(cve_match[1]))
        cves[cve_match[1]] = 1;
    }
  }
}

if(!empty_or_null(cves))
{
  cves = collib::cve_sort(keys(cves));
  cve_list = join(cves, sep:",");
  replace_kb_item(name:"Host/kernelcare/kernel-cves", value:cve_list);
}

if(!cve_list)
  exit(0, "KernelCare version " + version + " is installed, but we could find no patched CVEs.");

var report = "";
if(!empty_or_null(cve_list))
{
  report += 'Kernel CVEs determined to be patched through KernelCare:\n';
  var cves_block = '  ';
  var max_cves = max_index(cves);
  for(i = 0; i < max_cves; i++)
  {
    terminator = ', ';
    if(i == (max_cves - 1))
      terminator = '';
    else if ((i + 1) % 4 == 0)
      terminator = ',\n  ';

    cves_block += cves[i] + terminator;
  }
  report += cves_block;
}

if(report != "")
  report += '\n\n';

security_report_v4(
  port       : 0,
  severity   : SECURITY_NOTE,
  extra      : report
);